Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is setting up an AWS Lambda function that needs to retrieve and write items to an Amazon DynamoDB table in the same AWS account. The developer creates an IAM role named `LambdaDbAccessRole` to be used as the function's execution role. However, when attempting to save the Lambda function configuration, the developer receives an error stating that the AWS Lambda service is not authorized to assume the role. The developer checks the trust policy currently attached to `LambdaDbAccessRole` and finds the following document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:PutItem"
],
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Products"
}
]
}

How should the developer resolve this issue to allow the Lambda function to execute and interact with the DynamoDB table?

  1. Update the trust policy of `LambdaDbAccessRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action, and attach a separate identity-based permissions policy containing the DynamoDB actions to the role.Cevap
  2. B
    Modify the trust policy of `LambdaDbAccessRole` to add `"Principal": { "Service": "lambda.amazonaws.com" }` and `"Action": "sts:AssumeRole"` to the existing statement alongside the DynamoDB actions.
  3. C
    Configure the Lambda function to bypass the execution role by embedding the AWS access key and secret key of an IAM user with DynamoDB permissions directly in the function code.
  4. D
    Create a resource-based policy on the DynamoDB table that grants permission to `lambda.amazonaws.com` and use the AWS Account root user credentials to run the Lambda function.

Cevap

Update the trust policy of the execution role to allow the AWS Lambda service principal to assume the role, and attach a separate permissions policy to the role for DynamoDB access.
The trust policy of an IAM role defines which principals are allowed to assume it. For AWS Lambda to assume the execution role, the trust policy must allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action. The permissions to read and write to the DynamoDB table must be defined in a separate identity-based permissions policy attached to the role.

Adım Adım Çözüm

1
Analyze the error message showing that AWS Lambda is not authorized to assume the role.
Identify that the trust policy must explicitly allow the `lambda.amazonaws.com` service principal to perform `sts:AssumeRole`.
Before a Lambda function can execute, the AWS Lambda service must be allowed to assume its execution role.
2
Identify that the current trust policy document contains DynamoDB table actions instead of assumption actions.
Determine that these actions cannot remain in a trust policy because trust policies only control role assumption.
Trust policies are resource policies on the IAM role itself, meant only to authorize trusted principals to assume the role.
3
Separate trust relationships from identity permissions.
Move the DynamoDB actions to a standard identity-based permissions policy attached to the role, and configure the trust policy for `sts:AssumeRole`.
This configuration adheres to the AWS security model, where trust policies govern who can assume a role, and permissions policies govern what the assumed role can access.

Anahtar Kavram

Separation of IAM Trust Policies (defining which trust entities can assume the role) and Permissions Policies (defining access rights to AWS resources).
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru